{{- if .Values.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "aitbc-coordinator.fullname" . }}
  labels:
    {{- include "aitbc-coordinator.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "aitbc-coordinator.selectorLabels" . | nindent 6 }}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  # Allow traffic from ingress controller
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: ingress-nginx
    ports:
    - protocol: TCP
      port: http
  # Allow traffic from monitoring
  - from:
    - namespaceSelector:
        matchLabels:
          name: monitoring
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: prometheus
    ports:
    - protocol: TCP
      port: http
  # Allow traffic from wallet-daemon
  - from:
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: wallet-daemon
    ports:
    - protocol: TCP
      port: http
  # Allow traffic from same namespace for internal communication
  - from:
    - podSelector: {}
    ports:
    - protocol: TCP
      port: http
  egress:
  # Allow DNS resolution
  - to: []
    ports:
    - protocol: UDP
      port: 53
  # Allow PostgreSQL access
  - to:
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: postgresql
    ports:
    - protocol: TCP
      port: 5432
  # Allow external API calls (if needed)
  - to: []
    ports:
    - protocol: TCP
      port: 443
    - protocol: TCP
      port: 80
{{- end }}
